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Foreword 
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This Technical Specification (TS) has been produced by the ETSI 3 Generation Partnership Project (3GPP). 

The present document may refer to technical specifications or reports using their 3GPP identities, UMTS identities or 
GSM identities. These should be interpreted as being references to the corresponding ETSI deliverables. 

The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under www.etsi.org/kev . 

ETSI is a Custodian of the 3GPP Confidentiality and Integrity Algorithms f8 & f9, which have been developed through 
the collaborative efforts of the European Telecommunications Standards Institute (ETSI), the Association of Radio 
Industries and Businesses (ARIB), the Telecommunications Technology Association (TTA), the Tl Committee. 

The f8 & f 9 Algorithms Specifications may be used only for the development and operation of 3G Mobile 
Communications and services. Every Beneficiary must sign a Restricted Usage Undertaking with the Custodian and 
demonstrate that he fulfills the approval criteria specified in the Restricted Usage Undertaking. 

Furthermore, Mitsubishi Electric Corporation holds essential patents on the Algorithms. The Beneficiary must obtain a 
separate IPR License Agreement from Mitsubishi Electronic Corporation Japan. 

Licensing procedure with ETSI is the following: 

Every Beneficiary must send to the ETSI Secretariat two signed paper copies of the 3GPP Restricted Usage 
Undertaking with the Administrative Charge. Upon receipt of payment the Beneficiary will then receive one copy of the 
Restricted Usage Undertaking duly signed by ETSI by express mail. 

For further details of these procedures, see http://www.etsi.org/ . 
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Foreword 



rd , 



This Technical Specification has been produced by the 3 Generation Partnership Project (3GPP). 

The 3GPP Confidentiality and Integrity Algorithms f8 & f9 have been developed through the collaborative efforts of the 
European Telecommunications Standards Institute (ETSI), the Association of Radio Industries and Businesses ( ARIB), 
the Telecommunications Technology Association (TTA), the Tl Committee. 

The f 8 & f9 Algorithms Specifications may be used only for the development and operation of 3G Mobile 
Communications and services. Every Beneficiary must sign a Restricted Usage Undertaking with the Custodian and 
demonstrate that he fulfills the approval criteria specified in the Restricted Usage Undertaking. 

Furthermore, Mitsubishi Electric Corporation holds essential patents on the Algorithms. The Beneficiary must get a 
separate IPR License Agreement from Mitsubishi Electronic Corporation Japan. 

For details of licensing procedures, contact ETSI, ARIB, TTA or Tl. 



The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 

This specification has been prepared by the 3GPP Task Force, and gives a detailed specification of the 3GPP Algorithm 
KASUMI. KASUMI is a block cipher that forms the heart of the 3GPP confidentiality algorithm/S, and the 3GPP 
integrity algorithm/9. 

This document is the second of four, which between them form the entire specification of the 3GPP Confidentiality and 
Integrity Algorithms: 

3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 1:/S and 
f9 Specification". 

- 3GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services and 
System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; 
Document 2: KASUMI Specification". 

3GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity Algorithms; Document 3: 
Implementors' Test Data". 
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3GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services and System 
Aspects; 3G Security; Specification of the 3GPP ConfidentiaHty and Integrity Algorithms; Document 4: Design 
Conformance Test Data". 

The normative part of the specification of KASUMI is in the main body of this document. The annexes to this 
document are purely informative. Annex 1 contains illustrations of functional elements of the algorithm, while Annex 2 
contains an implementation program listing of the cryptographic algorithm specified in the main body of this document, 
written in the programming language C. 

Similarly the normative part of the specification of the f8 (confidentiality) and the/? (integrity) algorithms is in the 
main body of Document 1. The annexes of those documents, and Documents 3 and 4 above, are purely informative. 
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Scope 



This specification gives a detailed specification of the 3GPP Algorithm KASUMI. KASUMI is a block cipher that 
forms the heart of the 3GPP confidentiality algorithm_/8, and the 3GPP integrity algorithm/?. 
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NORMATIVE SECTION 

This part of the document contains the normative specification of the KASUMI algorithm. 
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1 Outline of the normative part 

Section 2 introduces the algorithm and describes the notation used in the subsequent sections. 
Section 3 defines the algorithm structure and its operation. 
Section 4 defines the basic components of the algorithm. 

1.1 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

[1] 3GPP TS 33.102 version 3.2.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Security Architecture". 

[2] 3GPP TS 33.105 version 3.1.0: "3rd Generation Partnership Project; Technical Specification 

Group Services and System Aspects; 3G Security; Cryptographic Algorithm Requirements". 

[3] 3GPP TS 35.201: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 1: f8 and f9 Specification". 

[4] 3GPP TS 35.202: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 2: KASUMI Specification". 

[5] 3GPP TS 35.203: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 3: Implementors' Test Data". 

[6] 3GPP TS 35.204: "3rd Generation Partnership Project; Technical Specification Group Services 

and System Aspects; 3G Security; Specification of the 3GPP Confidentiality and Integrity 
Algorithms; Document 4: Design Conformance Test Data". 

[7] ISO/IEC 9797-1:1999: "Information technology - Security techniques - Message Authentication 

Codes (MACs)". 



Introductory information 



2.1 Introduction 

Within the security architecture of the 3GPP system there are two standardised algorithms: A confidentiality algorithm 
f8, and an integrity algorithm /9. These algorithms are fully specified in a companion document[3]. Each of these 
algorithms is based on the KASUMI algorithm that is specified here. 

KASUMI is a block cipher that produces a 64-bit output from a 64-bit input under the control of a 128 -bit key. 
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2.2 Notation 

2.2.1 Radix 

We use the prefix Ox to indicate hexadecimal numbers. 

2.2.2 Bit/Byte ordering 

All data variables in this specification are presented with the most significant bit (or byte) on the left hand side and the 
least significant bit (or byte) on the right hand side. Where a variable is broken down into a number of sub-strings, the 
left most (most significant) sub-string consists of the most significant part of the original string and so on through to the 
least significant. 

For example if a 64-bit value X is subdivided into four 16-bit substrings P, Q, R, S we have: 

Z= 0x0 123456789 ABCDEF 

we have: 

P = 0x0123, Q = 0x4567, R = Ox89AB, S = OxCDEF. 

In binary this would be: 

X = 000000010010001 10100010101 1001 1 1 10001001 1010101 1 1 1001 101 1 1 101 1 1 1 

with P = 0000000 1 00 1 000 1 1 

2 = 0100010101100111 

R= 1000100110101011 
S= 1100110111101111 

2.2.3 Conventions 

We use the assignment operator '=', as used in several programming languages. When we write 

<variable> = <expression> 
we mean that <variable> assumes the value that <expression> had before the assignment took place. For instance, 

x = X + y + 3 
means 

(new value of x) becomes (old value of x) + (old value of y) h- 3. 

2.2.4 Subfunctions 

KASUMI decomposes into a number of subfunctions {FL, FO, FT) which are used in conjunction with associated sub- 
keys (KL, KO, KI) in a Feistel structure comprising a number of rounds (and rounds within rounds for some 
subfunctions). Specific instances of the function and/or keys are represented by XXij where i is the outer round number 
of KASUMI andj is the inner round number. 

For example the function FO comprises three rounds of the function FI, so we designate the third round of FI in the 
fifth round of KASUMI as FIs,3 
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2.2.5 List of Symbols 



= The assignment operator. 

® The bitwise exclusive-OR operation. 

II The concatenation of the two operands. 

«<n The left circular rotation of the operand by n bits. 

ROL( ) The left circular rotation of the operand by one bit. 

n The bitwise AND operation. 

u The bitwise OR operation. 



2.3 List of Functions and Variables 

fi( ) The round function for the i* round of KASUMI 

FI() A sub function within KASUMI that translates a 16-bit input to a 16-bit output using a 16-bit 

subkey. 

FL() A subfunction within KASUMI that translates a 32-bit input to a 32-bit output using a 32-bit 

subkey. 

FO() A subfunction within KASUMI that translates a 32-bit input to a 32-bit output using two 48-bit 

subkeys. 

K A 128-bit key. 

KL„KOi,KIi subkeys used within the i* round of KASUMI. 



S7[] 
S9[] 



An S-Box translating a 7-bit input to a 7-bit output. 
An S-Box translating a 9-bit input to a 9-bit output. 



3.1 



KASUMI operation 



Introduction 



(See figure 1 in Annex 1) 

KASUMI is a Feistel cipher with eight rounds. It operates on a 64-bit data block and uses a 128-bit key. In this section 
we define the basic eight-round operation. In section 4 we define in detail the make-up of the round function/j( ). 
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3.2 Encryption 

KASUMI operates on a 64-bit input / using a 128-bit key K to produce a 64-bit output OUTPUT, as follows: 

The input / is divided into two 32-bit strings Lg and Rq, where 

I = L„ II Ro 

Then for each integer / with 1 < / < 8 we define: 

Ri = Li.i, Li = Rii ® fi(Li.i, RKi ) 

This constitutes the i* round function of KASUMI, where/- denotes the round function with Li.j and round key 
RKi as inputs (see section 4 below). 

The result OUTPUT is equal to the 64-bit string (Lg II Rg) offered at the end of the eighth round. See figure 1 of 
Annex 1. 

In the specifications for the/5 and f9 functions we represent this transformation by the term: 

OUTPUT = KASUMI[ / ]k 



Components of KASUMI 



4.1 Function fi 

(See figure 1 in Annex 1) 

The function/( ) takes a 32-bit input / and returns a 32-bit output O under the control of a round key RKj, where the 
round key comprises the subkey triplet of (KLj, KOj, KIi). The function itself is constructed from two subfunctions; FL 
and FO with associated subkeys KLi (used with FL) and subkeys KOi and Kit (used with FO). 

The/( ) function has two different forms depending on whether it is an even round or an odd round. 

For rounds 1,3,5 and 7 we define: 

fi(I,RKi) = FO( FL( I, KLi), KOj, KIj ) 
and for rounds 2,4,6 and 8 we define: 

fi(I,KO = FL( FO( I, KOi, Kli ), KLi ) 

i.e. For odd rounds the round data is passed through FL{ ) and then FO{ ), whilst for even rounds it is passed through 
FO() and then FL(). 

4.2 Function FL 

(See figure 4 in Annex 1) 

The input to the function FL comprises a 32-bit data input / and a 32-bit subkey KLj. The subkey is split into two 16- 
bit subkeys, KL^ and KLj 2 where 

KLi = KLi,i II KLi,2. 

The input data / is split into two 16-bit halves, L and R where I = L\\ R. 

We define: 

R' = R®ROL{Lr\ KLti) 
L' = L®ROL{R'vj KLi2) 

The 32-bit output value i&(L'\\R'). 
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4.3 Function FO 

(See figure 2 in Annex 1) 

The input to the function FO comprises a 32-bit data input / and two sets of subkeys, a 48-bit subkey KOi and 48-bit 
subkey KIj. 

The 32-bit data input is split into two halves, Lo and Rq where I = LqW Ro- 

The 48-bit subkeys are subdivided into three 16-bit subkeys where 

KOi = KOi,i II KOi,2 II KOi,3 and KI; = KI;,! II KIi,2 II KIj^. 

Then for each integerj with 1 <j < 3 we define: 

Rj = FI(Lj.j ® KOij , Khj ) ® Rj.i 

Finally we return the 32-bit value (Lj II R3). 

4.4 Function Fl 

(See figure 3 in Annex 1 . The thick and thin lines in this diagram are used to emphasise the difference between the 
9-bit and 7-bit data paths respectively). 

The function FI takes a 16-bit data input / and 16-bit subkey KIij. The input / is split into two unequal components, a 
9-bit left half L# and a 7-bit right half /?# where I = Lo\\Ro- 

Similarly the key Kly is split into a 7-bit component Klijj and a 9-bit component KIij2 where Kly = Klijj II KIij^2- 

The function uses two S-boxes, S7 which maps a 7-bit input to a 7-bit output, and S9 which maps a 9-bit input to a 9-bit 
output. These are fully defined in section 4.5. It also uses two additional functions which we designate ZE{ ) and TR{ ). 
We define these as: 

ZE{ X ) takes the 7-bit value x and converts it to a 9-bit value by adding two zero bits to the most-significant end. 

TR{ X ) takes the 9-bit value x and converts it to a 7-bit value by discarding the two most-significant bits. 

We define the following series of operations: 

Li=Ro Ri = S9\Lo\®ZE{Ro) 

L2 = Ri® KIij,2 R2 = S7[L,] © TR(Ri) ® Klij,, 

Ls = R2 R3 = S9[L2\®ZE{R2) 

L4 = S7\L3\®TR{R3) R4 = R3 
The function returns the 16-bit value {L4 II R4). 
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4.5 



S-boxes 



The two S-boxes have been designed so that they may be easily implemented in combinational logic as well as by a 
look-up table. Both forms are given for each table. 

The input jc comprises either seven or nine bits with a corresponding number of bits in the output _y. We therefore have: 

X =x8\\x7 \\x6 \\x5 \\x4\\x3 \\x2 Wxl WxO 
and 

y =y8 \\y7 \\y6 \\y5 \\y4 \\y3 \\y2 Wyl WyO 

where the x8, y8 and x7,y7 bits only apply to S9, and the xO and yO bits are the least significant bits. 

In the logic equations: 

x0xlx2 implies xO n xl n x2 where n is the AND operator. 
® is the exclusive-OR operator. 

Following the presentation of the logic equations and the equivalent look-up table an example is given of the use of 
each. 

4.5.1 S7 

Gate Logic : 

yO =xlx3®x4©x0xlx4©x5©x2x5©x3x4x5®x6©x0x6©xlx6©x3x6©x2x4x6®xlx5x6 

©x4x5x6 
yl =x0xl®x0x4©x2x4®x5©xlx2x5©x0x3x5®x6©x0x2x6ffix3x6ffix4x5x6©l 
y2 =x0®x0x3©x2x3®xlx2x4©x0x3x4©xlx5®x0x2x5©x0x6ffix0xlx6®x2x6©x4x6®l 
y3 =xl®x0xlx2©xlx4®x3x4©x0x5©x0xlx5®x2x3x5©xlx4x5©x2x6®xlx3x6 
y4 =x0x2®x3©xlx3®xlx4©x0xlx4©x2x3x4®x0x5©xlx3x5®x0x4x5®xlx6©x3x6 

©x0x3x6ffix5x6©l 
y5 =x2®x0x2©x0x3®xlx2x3©x0x2x4©x0x5®x2x5©x4x5®xlx6®xlx2x6®x0x3x6 

©X3x4x6®x2x5x6©l 
y6 =xlx2®x0xlx3©x0x4®xlx5®x3x5©x6®x0xlx6©x2x3x6®xlx4x6®x0x5x6 



Decimal Table : 




















54, 50, 62, 


56, 


22, 34 


94, 96, 38, 


6 


63, 93, 


2, 18,123, 


33, 


55,113, 39, 


114, 


21, 67 


65 


12 


47, 


73 


46 


27, 


25, 111, 124, 


81, 


53, 9,121, 


79, 


52, 60 


58 


48 


101, 


127 


40 


120, 


104, 70, 71, 


43, 


20,122, 72, 


61, 


23,109 


13 


100 


77, 


1 


16 


7, 


82, 10,105, 


98, 


117,116, 76, 


11, 


89,106 





125 


118, 


99 


86 


69, 


30, 57,126, 


87, 


112, 51, 17, 


5, 


95, 14 


90 


84 


91, 


8 


35 


103, 


32, 97, 28, 


66, 


102, 31, 26, 


45, 


75, 4 


85 


92 


37, 


74 


80 


49, 


68, 29,115, 


44, 


64, 107, 108, 


24, 


110, 83 


36 


78 


42, 


19 


15 


41, 


88,119, 59, 


3 



Example: 

If we have an input value = 38, then using the decimal table S7[38] = 58. 
For the combinational logic we have: 

38 = 01001102 ^ x6 = 0, x5=l,x4=0, x3=0, x2=l,xl=l,x0=0 
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which gives us: 



yo = oeoeoe i e i eoeoeoeoeoeoeoeo = o 
y 1 = oeoeoe i e i eoeoeoeoeoe i = i 

y2 = oeoeoeoeoe i eoeoeoeoeoe i = o 
y3 = leoeoeoeoeoeoeoeoeo = i 

y4 = oeoeoeoeoeoeoeoeoeoeoeoeoei = i 
y5 = 1 eoeoeoeoeoe ieoeoeoeoeoeoei= i 
y6 = 1 eoeoe i eoeoeoeoeoeo = o 



Thus y = 01 110102 = 58 



4.5.2 S9 



Gate Logic : 



yO = X0x2©x3©x2x5©x5x6®x0x7®xlx7©x2x7©x4x8©x5x8®x7x8®l 

yl = Xl©x0xl®x2x3©x0x4©xlx4©x0x5©x3x5©x6©xlx7®x2x7®x5x8©l 

y2 = Xl©x0x3®x3x4©x0x5®x2x6®x3x6©x5x6®x4x7©x5x7®x6x7®x8©x0x8®l 

y3 = X0©xlx2ffix0x3®x2x4ffix5ffix0x6©xlx6ffix4x7ffix0x8ffixlx8®x7x8 

y4 = X0xl©xlx3ffix4©x0x5ffix3x6ffix0x7©x6x7ffixlx8®x2x8ffix3x8 

y5 = X2©xlx4©x4x5©x0x6@xlx6ffix3x7©x4x7©x6x7ffix5x8ffix6x8©x7x8©l 

y6 = X0©x2x3ffixlx5©x2x5ffix4x5ffix3x6©x4x6©x5x6©x7ffixlx8©x3x8©x5x8©x7xg 

y7 = X0xl©x0x2®xlx2©x3®x0x3®x2x3©x4x5®x2x6©x3x6®x2x7®x5x7©x8©l 

y8 = X0xl©x2©xlx2©x3x4©xlx5©x2x5©xlx6©x4x6©x7©x2x8©x3x8 

Decimal Table : 



167 


239 


161 


379 


391 


334 


9 


338 


38 


226 


48 


358 


452 


385 


90 


397, 


183 


253 


147 


331 


415 


340 


51 


362 


306 


500 


262 


82 


216 


159 


356 


177, 


175 


241 


489 


37 


206 


17 





333 


44 


254 


378 


58 


143 


220 


81 


400, 


95 


3 


315 


245 


54 


235 


218 


405 


472 


264 


172 


494 


371 


290 


399 


76, 


165 


197 


395 


121 


257 


480 


423 


212 


240 


28 


462 


176 


406 


507 


288 


223, 


501 


407 


249 


265 


89 


186 


221 


428 


164 


74 


440 


196 


458 


421 


350 


163, 


232 


158 


134 


354 


13 


250 


491 


142 


191 


69 


193 


425 


152 


227 


366 


135, 


344 


300 


276 


242 


437 


320 


113 


278 


11 


243 


87 


317 


36 


93 


496 


27, 


487 


446 


482 


41 


68 


156 


457 


131 


326 


403 


339 


20 


39 


115 


442 


124, 


475 


384 


508 


53 


112 


170 


479 


151 


126 


169 


73 


268 


279 


321 


168 


364, 


363 


292 


46 


499 


393 


327 


324 


24 


456 


267 


157 


460 


488 


426 


309 


229, 


439 


506 


208 


271 


349 


401 


434 


236 


16 


209 


359 


52 


56 


120 


199 


277, 


465 


416 


252 


287 


246 


6 


83 


305 


420 


345 


153 


502 


65 


61 


244 


282, 


173 


222 


418 


67 


386 


368 


261 


101 


476 


291 


195 


430 


49 


79 


166 


330, 


280 


383 


373 


128 


382 


408 


155 


495 


367 


388 


274 


107 


459 


417 


62 


454, 


132 


225 


203 


316 


234 


14 


301 


91 


503 


286 


424 


211 


347 


307 


140 


374, 


35 


103 


125 


427 


19 


214 


453 


146 


498 


314 


444 


230 


256 


329 


198 


285, 


50 


116 


78 


410 


10 


205 


510 


171 


231 


45 


139 


467 


29 


86 


505 


32, 


72 


26 


342 


150 


313 


490 


431 


238 


411 


325 


149 


473 


40 


119 


174 


355, 


185 


233 


389 


71 


448 


273 


372 


55 


110 


178 


322 


12 


469 


392 


369 


190, 


1 


109 


375 


137 


181 


88 


75 


308 


260 


484 


98 


272 


370 


275 


412 


111, 


336 


318 


4 


504 


492 


259 


304 


77 


337 


435 


21 


357 


303 


332 


483 


18, 


47 


85 


25 


497 


474 


289 


100 


269 


296 


478 


270 


106 


31 


104 


433 


84, 


414 


486 


394 


96 


99 


154 


511 


148 


413 


361 


409 


255 


162 


215 


302 


201, 


266 


351 


343 


144 


441 


365 


108 


298 


251 


34 


182 


509 


138 


210 


335 


133, 


311 


352 


328 


141 


396 


346 


123 


319 


450 


281 


429 


228 


443 


481 


92 


404, 


485 


422 


248 


297 


23 


213 


130 


466 


22 


217 


283 


70 


294 


360 


419 


127, 


312 


377 


7 


468 


194 


2 


117 


295 


463 


258 


224 


447 


247 


187 


80 


398, 


284 


353 


105 


390 


299 


471 


470 


184 


57 


200 


348 


63 


204 


188 


33 


451, 


97 


30 


310 


219 


94 


160 


129 


493 


64 


179 


263 


102 


189 


207 


114 


402, 


438 


477 


387 


122 


192 


42 


381 


5 


145 


118 


180 


449 


293 


323 


136 


380, 


43 


66 


60 


455 


341 


445 


202 


432 


8 


237 


15 


376 


436 


464 


59 


461 
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Example: 

If we have an input value = 138, then using the decimal table S9[138] = 339. 
For the combinational logic we have: 

138 = 0100010102 ^ x8 = 0, x7= l,x6 = 0, x5=0, x4=0, x3=l,x2=0, xl=l,xO=0 
which gives us: 

yo = oe 1 eoeoeoe i eoeoeoeoe i = i 

yi = leoeoeoeoeoeoeoeieoeoei = i 

y2 = 1 eoeoeoeoeoeoeoeoeoeoeoe i = o 

y3 = oeoeoeoeoeoeoeoeoeoeo = o 

y4 = oe 1 eoeoeoeoeoeoeoeo = i 

y5 = oeoeoeoeoe i eoeoeoeoeoe i = o 

y6 = oeoeoeoeoeoeoeoeieoeoeoeo =i 

y7 = oeoeoe i eoeoeoeoeoeoeoeoe i = o 

y8 = oeoeoeoeoeoeoeoeieoeo = i 

Thus y= 1010100112 = 339 



4.6 Key Schedule 



KASUMI has a 128-bit key K. Each round of KASUMI uses 128 bits of key that are derived from K. Before the round 
keys can be calculated two 16-bit arrays Kj and Kj' (j=\ to 8) are derived in the following manner: 

The 128-bit key K is subdivided into eight 16-bit values K1...K8 where 

K = K1IIK2IIK3II...IIK8. 

A second array of subkeys, Kj'is, derived from Kj by applying: 

For each integer j with 1 < j < 8 

Kj'= Kjecj 

Where Cj is the constant value defined in table 2. 
The round subkeys are then derived from Kj and Kj'in the manner defined in table 1 . 

Table 1 : Round subkeys 



KLi,i 
KLi,2 

KOi,i 
K0i2 
K0i,3 

Kli,i 

Kli,2 
Kli,3 



1 


2 


3 


4 


5 


6 


7 


8 


K1«<1 


K2«<1 


K3«<1 


K4«<1 


K5«<1 


K6«<1 


K7«<1 


K8«<1 


K3' 


K4' 


K5' 


K6' 


K7' 


K8' 


K1' 


K2' 


K2«<5 


K3«<5 


K4«<5 


K5«<5 


K6«<5 


K7«<5 


K8«<5 


K1«<5 


K6«<8 


K7«<8 


K8«<8 


K1«<8 


K2«<8 


K3«<8 


K4«<8 


K5«<8 


K7«<13 


K8«<13 


K1«<13 


K2«<13 


K3«<13 


K4«<13 


K5«<13 


K6«<13 


K5' 


K6' 


K7' 


K8' 


K1' 


K2' 


K3' 


K4' 


K4' 


K5' 


K6' 


K7' 


K8' 


K1' 


K2' 


K3' 


KB' 


K1' 


K2' 


K3' 


K4' 


K5' 


K6' 


K7' 
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Table 2: Constants 



C1 


0x0123 


C2 


0x4567 


C3 


0x89AB 


C4 


OxCDEF 


C5 


OxFEDC 


C6 


0xBA98 


C7 


0x7654 


C8 


0x3210 
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INFORMATIVE SECTION 

This part of the document is purely informative and does not form part of the normative specification of KASUMI. 
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Annex 1 (informative): 

Figures of the KASUIVII Algorithm 






KI 



i,J,2 



Fig.2: FO Function Fig.3: FI Function 




Fig. 1: KASUMI 



I 1 bitwise AND operation 
I I bitwise OR operation 
<^<^<^ one bit left rotation 

Fig.4: FL Function 
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KASUMI has a number of characteristics that may be exploited in a hardware implementation and these are highlighted 
here. 

The simple key schedule is easy to implement in hardware. 

The S-Boxes have been designed so that they may be implemented by a small amount of combinational logic 
rather than by large look-up tables. 

The S7-Box and S9-Box operations in the FI function may be carried out in parallel (see alternative presentation 
in figure 5). 

The Fli 1 and Fli 2 operations may be carried out in parallel (see alternative presentation in figure 6). 




(>^^-K3 





Fig.5: FI Function 



Fig.6: FO Function 
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Annex 2 (informative): 
Simulation Program Listing 

Header file 

/-. 

* Kasumi . h 

^ ^/ 

typedef unsigned char u8; 
typedef unsigned short ul6; 
typedef unsigned long u32; 

void KeySchedule ( u8 *key ) ; 
void Kasumi ( u8 *data ) ; 

CCode 

/* 

* Kasumi . c 

* A sample implementation of KASUMI, the core algorithm for the 

* 3GPP Confidentiality and Integrity algorithms. 

* This has been coded for clarity, not necessarily for efficiency. 

'^ This will compile and run correctly on both Intel (little endian) 

* and Sparc (big endian) machines. (Compilers used supported 32-bit ints) . 

* Version 1.1 08 May 2000 

* */ 

#include "Kasumi. h" 

/* 16 bit rotate left */ 

#define R0L16(a,b) (ul6) ( (a«b) I (a>> (16-b) ) ) 

I '^ unions: used to remove "endian" issues */ 

typedef union { 

u32 b32; 

ul6 bl6 [2] ; 

u8 b8[4]; 
} DWORD ; 

typedef union { 

ul6 bl6; 

u8 b8[2]; 
} WORD; 

/* globals: The subkey arrays */ 

static ul6 KLil[8], KLi2[8]; 

static ul6 K0il[8], KOi2[8], KOi3[8]; 

static ul6 KIil[8], KIi2[8], KIi3[8]; 



/* 

* FI() 

* The FT function (fig 3). It includes the S7 and S9 tables. 

* Transforms a 16-bit value. 

* */ 

static ul6 FT ( ul6 in, ul6 subkey ) 
{ 

ul6 nine, seven; 
static ul6 S7 [] = { 

54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18,123, 33, 
55,113, 39,114, 21, 67, 65, 12, 47, 73, 46, 27, 25,111,124, 81, 
53, 9,121, 79, 52, 60, 58, 48,101,127, 40,120,104, 70, 71, 43, 
20,122, 72, 61, 23,109, 13,100, 77, 1, 16, 7, 82, 10,105, 98, 
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117, 116 


76 


11 


89 


106 


0, 


125, 


L18, 


99, 


86, 


69, 


30, 


57, 


126, 


87, 


112, 51 


17, 5, 


95, 


14, 


90, 


84, 


91, 


8, 


35,103, 


32, 


37, 28, 66, 


102, 31 


26, 45 


75 


4, 


85, 


92, 


37, 


74, 


80, 


49, 


68, 


29, 


L15, 44, 


64,107, 


L08, 24, 


LIO, 


83, 


36, 


78, 


42, 


19, 


15, 


41, 


88, 


L19, 


5 9, 3 } ; 


static ul6 S9 [] = { 
























167,239 


161,379 


391 


334 


9 


338 


38 


226 


48 


358 


452 


385 


90,397, 


183,253 


147 


331 


415 


340 


51 


362 


306 


500 


262 


82 


216 


159 


356 


177, 


175,241 


489 


37 


206 


17 





333 


44 


254 


378 


58 


143 


220 


81 


400, 


95, 3 


315 


245 


54 


235 


218 


405 


472 


264 


172 


494 


371 


290 


399 


76, 


165, 197 


395 


121 


257 


480 


423 


212 


240 


28 


462 


176 


406 


507 


288 


223, 


501,407 


249 


265 


89 


186 


221 


428 


164 


74 


440 


196 


458 


421 


350 


163, 


232,158 


134 


354 


13 


250 


491 


142 


191 


69 


193 


425 


152 


227 


366 


135, 


344,300 


276 


242 


437 


320 


113 


278 


11 


243 


87 


317 


36 


93 


496 


27, 


487,446 


482 


41 


68 


156 


457 


131 


326 


403 


339 


20 


39 


115 


442 


124, 


475, 384 


508 


53 


112 


170 


479 


151 


126 


169 


73 


268 


279 


321 


168 


364, 


363,292 


46 


499 


393 


327 


324 


24 


456 


267 


157 


460 


488 


426 


309 


229, 


439, 506 


208 


271 


349 


401 


434 


236 


16 


209 


359 


52 


56 


120 


199 


277, 


465, 416 


252 


287 


246 


6 


83 


305 


420 


345 


153 


502 


65 


61 


244 


282, 


173,222 


418 


67 


386 


368 


261 


101 


476 


291 


195 


430 


49 


79 


166 


330, 


280,383 


373 


128 


382 


408 


155 


495 


367 


388 


274 


107 


459 


417 


62 


454, 


132,225 


203 


316 


234 


14 


301 


91 


503 


286 


424 


211 


347 


307 


140 


374, 


35,103 


125 


427 


19 


214 


453 


146 


498 


314 


444 


230 


256 


329 


198 


285, 


50, 116 


78 


410 


10 


205 


510 


171 


231 


45 


139 


467 


29 


86 


505 


32, 


72, 26 


342 


150 


313 


490 


431 


238 


411 


325 


149 


473 


40 


119 


174 


355, 


185,233 


389 


71 


448 


273 


372 


55 


110 


178 


322 


12 


469 


392 


369 


190, 


1,109 


375 


137 


181 


88 


75 


308 


260 


484 


98 


272 


370 


275 


412 


111, 


336,318 


4 


504 


492 


259 


304 


77 


337 


435 


21 


357 


303 


332 


483 


18, 


47, 85 


25 


497 


474 


289 


100 


269 


296 


478 


270 


106 


31 


104 


433 


84, 


414,486 


394 


96 


99 


154 


511 


148 


413 


361 


409 


255 


162 


215 


302 


201, 


266,351 


343 


144 


441 


365 


108 


298 


251 


34 


182 


509 


138 


210 


335 


133, 


311,352 


328 


141 


396 


346 


123 


319 


450 


281 


429 


228 


443 


481 


92 


404, 


485, 422 


248 


297 


23 


213 


130 


466 


22 


217 


283 


70 


294 


360 


419 


127, 


312,377 


7 


468 


194 


2 


117 


295 


463 


258 


224 


447 


247 


187 


80 


398, 


284,353 


105 


390 


299 


471 


470 


184 


57 


200 


348 


63 


204 


188 


33 


451, 


97, 30 


310 


219 


94 


160 


129 


493 


64 


179 


263 


102 


189 


207 


114 


402, 


438,477 


387 


122 


192 


42 


381 


5 


145 


118 


180 


449 


293 


323 


136 


380, 


43, 66 


60 


455 


341 


445 


202 


432 


8, 


?37, 


15, 


376, 


536, 


564, 


59, 


561}; 



/* The sixteen bit input is split into two unequal halves, 
* nine bits and seven bits - as is the subkey 

nine = (ul6) (in>>7); 
seven = (ul6) (in&0x7F) ; 

/* Now run the various operations */ 

nine = (ul6) (S9 [nine] "^ seven); 

seven = (ul6) (S7 [seven] "^ (nine & 0x7F) ) ; 

seven '^= (sub]<:ey>>9) ; 
nine ^= (subkey&OxlFF) ; 

nine = (ul6) (S9 [nine] "^ seven); 

seven = (ul6) (S7 [seven] "^ (nine & 0x7F) ) ; 

in = (ul6) ((seven<<9) + nine); 

return ( in ) ; 



* FOO 

* The F0() function. 

* Transforms a 32-bit value. Uses <index> to identify the 

* appropriate subkeys to use. 

static u32 FO ( u32 in, int index ) 
{ 

ul6 left, right; 

/* Split the input into two 16-bit words */ 

left = (ul6) (in>>16) ; 
right = (ul6) in; 

/* Now apply the same basic transformation three times 
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left '~= KOil [index] ; 

left = FI ( left, Kill [index] ); 

left ^= riglit; 

rigtit ^= K0i2 [index]; 

riglit = FI ( riglit, KIi2 [index] ); 

riglit ^= left; 

left ^= K0i3 [index]; 

left = FI ( left, KIi3 [index] ); 

left ^= riglit; 

in = (( (u32) riglit) <<16) ileft; 

return ( in ) ; 



* FLO 

* The FLO function. 

* Transforms a 32-bit value. Uses <index> to identify the 

* appropriate subkeys to use. 

static u32 FL ( u32 in, int index ) 
{ 

u 1 6 1 , r , a , b ; 

I '^ split out the left and right halves */ 

1 = (ul6) (in»16) ; 
r = (ul6) (in) ; 

/* do the FLO operations */ 

a = (ul6) (1 S KLil [index] ) ; 
r ^= R0L16 (a, 1) ; 

b = (ul6) (r I KLi2 [index] ) ; 
1 '-= R0L16 (b, 1) ; 

/* put the two halves back together */ 

in = ( ( (u32)l)«16) + r; 

return ( in ) ; 



* Kasumi ( ) 

* the Main algorithm (fig 1) . Apply the same pair of operations 

* four times. Transforms the 64-bit input. 

* */ 

void Kasumi ( u8 *data ) 
{ 

u32 left, right, temp; 

DWORD *d; 

int n; 

/* Start by getting the data into two 32-bit words (endian cored) */ 

d = (DWORD*) data; 

left = ( ( (u32)d[0] .b8 [0] )«24) + ( ( (u32)d[0] .b8 [1] )«16) 
+ (d[0] .b8 [2]«8) + (d[0] .b8 [3] ) ; 

right = ( ( (u32 ) d [ 1 ] .b8 [ ] ) «24 ) + ( ( (u32 ) d [ 1 ] .b8 [ 1 ] ) «1 6) 
+ (d[l] .b8 [2]«8) + (d[l] .b8 [3] ) ; 
n = 0; 
do[ temp = FL ( left, n ); 

temp = FO ( temp, n++ ); 

right ^= temp; 

temp = FO ( right, n ); 

temp = FL ( temp, n++ ); 

left ^= temp; 
}while ( n<=7 ) ; 

/* return the correct endian result */ 

d[0].b8[0] = (u8) (left>>24) ; d[l].b8[0] = (u8) (right>>24 ) ; 

d[0].b8[l] = (u8) (left>>16) ; d[l].b8[l] = (u8) (right>>16) ; 
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d[0].b8[2] = (u8) (left»8) ; d[l].b8[2] = (u8) (right»8) ; 

d[0].b8[3] = (u8)(left); d[l].b8[3] = (u8) (right) ; 

} 

/* 

* KeySchedule 

* Build the key schedule. Most "key" operations use 16-bit 

* subkeys so we build ul6-sized arrays that are "endian" correct. 

* */ 

void KeySchedule ( u8 *k ) 
{ 

static ul6 C[] = { 

0x0123, 0x4567, 0x89AB, OxCDEF, OxFEDC, 0xBA98, 0x7 654 , 0x3210 } ; 

ul6 key [8] , Kprime[8] ; 

WORD *kl6; 

int n; 

/* Start by ensuring the subkeys are endian correct on a 16-bit basis */ 

kl6 = (WORD *)k; 

f or ( n=0; n<8; ++n ) 

key[n] = (ul6) ( (kl6 [n] .b8 [0] «8) + (kl6 [n] .b8 [ 1 ] ) ) ; 

/* Now build the K' [] keys */ 

f or ( n=0; n<8; ++n ) 

Kprime[n] = (ul6)(key[n] " C[n]); 

/* Finally construct the various sub keys */ 

f or ( n=0; n<8; ++n ) 
{ 

KLil[n] = R0L16 (key [n] , 1) ; 

KLi2[n] = Kprime [ (n+2) S0x7] ; 

KOil[n] = R0L16 (key [ (n+1) S0x7] , 5) ; 

K0i2[n] = R0L16 (key [ (n + 5) S0x7] , 8) ; 

K0i3[n] = R0L16 (key [ (n+6) S0x7] , 13) ; 

KIil[n] = Kprime [ (n+4) S 0x7] ; 

KIi2[n] = Kprime [ (n + 3) S0x7] ; 

KIi3[n] = Kprime [ (n+7) S0x7] ; 
} 
} 

/* 

* end of kasumi.c 
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